Passkeys carry 36% of sign-ins, up from 26%: the gap to enrolment nearly closed

01The line: two readings, and the gap between having a passkey and using it

The Index has two published points. In October 2025, nine companies reported that 26% of sign-ins used a passkey. In October 2026, 12 of the 15 participants reported the measure, and their unweighted average was 36%. Sign-in share counts re-authentication and excludes account recovery.²³

Enrolment moved less. 90% of active accounts are eligible for a passkey, and 42% of eligible accounts have one, which FIDO puts at roughly 38% of all accounts. A year earlier the figure was about 34%. In FIDO’s words, “people who have a passkey are now using it more of the time”. Even so, 8 of the 10 participants that report both measures still see fewer passkey sign-ins than passkey holders.²

02What drives it: defaults, measured results and regulators

Platform defaults. Google made passkeys “the default option across personal Google Accounts” on 10 October 2023, switching on “Skip password when possible” for users.⁴ On 1 May 2025 Microsoft made brand-new Microsoft accounts “passwordless by default” and began steering existing users to their best method. It reported nearly a million passkeys registered a day, a sign-in success rate of about 98% against 32% for passwords, and password use down by more than 20% in its experiments.⁵

The participants’ own numbers. Passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA (n=12), and save an average of 27 seconds each (n=9). All 8 participants that measure phishing report fewer successful attacks since deploying passkeys, and all 4 that shared savings report lower SMS one-time-code bills, from about US$1 million to hundreds of millions of dollars a year. Two participants still show a password or code before the passkey, even to users who have one; one of them estimates that putting the passkey first would roughly double its passkey share. 9 of 13 plan passwordless accounts within 12 months.²

Regulators. NIST’s SP 800-63B-4, final in August 2025, says verifiers “SHALL offer at least one phishing-resistant authentication option” at its middle assurance level, and that US federal agencies “SHALL require” phishing-resistant sign-in for their staff and contractors.⁶ In the UAE, banks began phasing out SMS and email codes on 25 July 2025 under Central Bank directions, with full discontinuation due by March 2026, Gulf News reported; the replacement is in-app approval, not passkeys specifically.⁷

03What it means for a company's staff sign-in

The Index measures consumer accounts, not employees. The workforce picture is slower: in FIDO’s April survey, 57% of organisations still signed staff in mainly with a factor a fake page can collect, which our 7 May piece on workforce passkeys takes apart, with prices at five identity providers.⁸ The Index still carries three lessons for whoever runs sign-in at work.

First, count sign-ins, not enrolments: the 2025 gap, 34% of accounts against 26% of sign-ins, shows that holding a passkey is not using it. Second, the order of the sign-in screen matters: one participant estimates that showing the passkey first, and changing nothing else, would roughly double its passkey share. Third, a passkey offered beside a password and an SMS code leaves those weaker paths open, which is why FIDO names passwordless accounts as the next step.²